Principal EDR, XDR Engineer

MS Companies

. Lead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon .

Posted 10/12/2026full-timeLondon • United KingdomLeadWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in EDR and XDR technologies, particularly Microsoft Defender XDR and CrowdStrike Falcon, with a strong focus on threat hunting, incident response, and security architecture. Proven ability to develop detection content and implement engineering standards, including Detection-as-Code and CI/CD practices, while providing technical leadership and mentoring within complex enterprise environments.

Highest-signal resume keywords

Microsoft Defender XDRCrowdStrike FalconThreat HuntingDetection-as-CodeCI/CD Practices

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

EDRXDRSecurity EngineeringSecurity OperationsCyber DefenceDetection Content DevelopmentKQLMITRE ATT&CKIncident InvestigationTechnical Documentation

Soft Skills

Technical LeadershipMentoringStakeholder Influence

Tools & Technologies

Microsoft SentinelSecurity Monitoring Architecture

Industry Keywords

Threat IntelligenceIncident ResponsePlatform OptimisationEnterprise Security Monitoring

About the role

Key responsibilities & impact

Lead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon
Develop, tune and validate high-fidelity detections across EDR, XDR and Microsoft Sentinel
Use MITRE ATT&CK, threat intelligence and incident insights to improve coverage and alert quality
Perform advanced threat hunting and support complex investigations with Security Operations and Incident Response teams
Provide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap
Evaluate new capabilities to strengthen detection and response maturity
Establish engineering standards, Detection-as-Code and CI/CD practices
Maintain technical documentation, mentor engineers and advise stakeholders on platform effectiveness and strategic improvements

Requirements

What you’ll need

Extensive senior-level experience in EDR, XDR, security engineering, security operations or cyber defence within complex enterprise environments
Deep subject-matter expertise in Microsoft Defender XDR and CrowdStrike Falcon, with strong knowledge of endpoint detection, platform optimisation and enterprise security monitoring
Proven experience developing detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting and MITRE ATT&CK-aligned analytics
Strong capability in threat hunting, threat intelligence integration, incident investigation and response, with the ability to identify and resolve detection gaps
Experience leading security architecture, platform integrations and technical projects, using Detection-as-Code, CI/CD and engineering best practices while influencing stakeholders and producing clear technical documentation

Benefits

Comp & perks

20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you’ve completed your probation
Competitive holiday allowance with the option to buy more
Discretionary bonus schemes linked to your performance and ours
Strong pension and life assurance to help plan for the future
Tailored induction and training to support your development from day one
Exclusive perks and savings through our M&S Choices portal
Market-leading family policies, including parental, adoption and neonatal leave
24/7 wellbeing support, including virtual GP access and mental health services
One paid volunteer day a year to support a cause that matters to you